Perimeter
6/30/2011
04:52 PM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Mass-Meshing A Gumblar Creation

Who doesn't love a new buzzword? 'Mass-meshing' is a new term that describes an old problem first presented by the Gumblar attacks in 2009

Recent media reports point to a supposed new type of attack that has been dubbed "mass-meshing" by the folks over at Amortize.

The Amortize report states, “We want to report a new type of mass-scale drive-by download attack that we'll dub "Mass Meshing Injection."" The report then goes on to explain what it is and how it differs from a SQL injection attack. The crux of their concern is that in this “new type” of attack, “Every redirector is itself an infected domain, which means blacklisting becomes more difficult and prune to false alerts.”

But that was exactly the case two years ago with Gumblar. From our ScanSafe blog post then:

“In a typical outbreak situation, there are compromised websites that act as a conduit for malware hosted on an attacker owned site. But in this case, the malware resides on thousands of legitimate (but compromised) websites.”

Of course, all those Gumblar-backdoored websites proved fertile grounds for other attackers to abuse, and in October 2009 we saw Zeus adapting this same method:

“Interestingly, compromised pages are also being injected with external source references to the malware contained on other compromised sites. Those who followed last week's report of the newest Gumblar technique will recall that unlike traditional compromises which simply inject pointers to malware hosted on an attacker-owned domain, in these attacks the compromised domain is also acting as host for the malware itself."

At the time, we also noted that:

"This method of attack complicates remediation via technologies that rely on blacklisting because the number of compromised websites (now acting as malware hosts) is in the thousands.”

And we also reported the same method being used in a random malvertising attack in 2010:

“ScanSafe STAT has been investigating an ongoing series of attacks which has been a hotbed for zero day exploits over the first quarter of 2010. The attackers are using three layers of legitimate sites. Two layers are compromised websites used to host malicious content that is then subsequently pushed to a third layer of legitimate websites via syndicated ads.”

The above references aren't to minimize the severity of mass-meshing style attacks, but rather just to point out that the mass-meshing technique isn't new.

Indeed, today it is pretty common to see interwoven attacks in which the compromised sites work in concert to interchangeably serve as conduit, redirector, and/or the actual malware host.

And while it does pose some additional challenges, overall security vendors seem to be coping fairly well with it. (Though obviously anyone relying purely on blacklisting would have a problem, but most use more layered defenses).

I have to say though that while the attack method isn't new, mass-meshing is a pretty cool, new buzzword to describe it.

Mary Landesman is an antivirus professional and senior security researcher for ScanSafe, now part of Cisco. In 2009 she was awarded a Microsoft MVP for her work in consumer security.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2970
Published: 2014-07-31
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5139. Reason: This candidate is a duplicate of CVE-2014-5139, and has also been used to refer to an unrelated topic that is currently outside the scope of CVE. This unrelated topic is a LibreSSL code change adding functionality ...

CVE-2014-0914
Published: 2014-07-30
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management f...

CVE-2014-0915
Published: 2014-07-30
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8...

CVE-2014-0947
Published: 2014-07-30
Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authenticated users to execute arbitrary code via a crafted update site.

CVE-2014-0948
Published: 2014-07-30
Unspecified vulnerability in IBM Rational Software Architect Design Manager and Rational Rhapsody Design Manager 3.x and 4.x before 4.0.7 allows remote authenticated users to execute arbitrary code via a crafted ZIP archive.

Best of the Web
Dark Reading Radio